Blog

The Keane Organization's EVP of Corporate Development, David McCrystal, was recently quoted in the mutual fund publication Ignites regarding data risk and the FACTA Red Flag Rule. McCrystal explained that while funds have used the extended enforcement deadline (now delayed from May 1 to August 1 2009) to plug some compliance holes, firms are still exposed to fraud tied to legacy data. This exposure is evidenced through the results of Keane's Investor Data Quality Program over the last two years. While firms may have a good handle on the information coming into their systems when accounts are opened, what is not widely addressed is the quality of the data thereafter. The article reflects certain statistics and risk analysis presented in a web seminar (entitled Proactively Managing “Red Flag” Risks: Mitigating Commonly Overlooked Fraud, ID Theft, and Asset Risk Exposures in Your Legacy Data) recently conducted by McCrystal and Peter Teuten, President and Chief Technology Officer of Keane Business Risk Management Solutions.

In the Ignites article  (password protected)  McCrystal described the potential for fraud to occur, for instance, when a customer dies and a family member, or worse yet an unrelated third party, uses the decedent's identifying information for fraudulent purposes. Keane's IDQ data risk assessment has measured the potential risk exposure for over 150 fund companies since 2007. Keane’s analysis has found that for mutual funds, 0.5% to 3% of seemingly active registered investors are in fact deceased without the company’s knowledge. Quoting from the article, “Of that range, 33% of them will be a problem that is greater than five years old,” McCrystal said. “That is how long it has persisted without [funds'] knowing.” Further, 15% of these investors have been deceased for more than 10 years. Address discrepancies, Social Security errors and use of another person’s or deceased person’s Social Security number are the most common problems. In the article, McCrystal further explained, “The red flag rule asks that you look for areas where there is potential exposure and mentions evaluating the data quality, and specifically mentions the life status of the owner, so it’s something that needs to be looked at on an ongoing basis.”